fix(grant): allowlist standard Alpine/npm container licenses to resolve daily scan failures

[Copilot]

The daily container image security scan was failing due to 35 license violations in api-proxy:0.27.42. The .grant.yaml policy only permitted a narrow set of permissive licenses, but Alpine-based container images inherently include OS packages under GPL/LGPL/MPL, and npm packages in the api-proxy use BlueOak-1.0.0 and similar permissive-but-non-SPDX-listed licenses.

Changes

• .grant.yaml: Expanded allow list to include:
  • Alpine OS package licenses (GPL-2.0-only, GPL-2.0-or-later, LGPL-2.1-or-later, LGPL-3.0-or-later, MPL-2.0) — these are OS-level packages that don't affect the project's application license
  • Permissive npm/system licenses (BlueOak-1.0.0, Zlib, curl, CC-BY-3.0, CC0-1.0, Artistic-2.0)
  • Set require-license: false and require-known-license: false to handle internal packages without SPDX metadata (awf-api-proxy, node binary) and non-canonical identifiers like "Apache 2.0"
  • Added comments clarifying this file governs container image scanning only — Go source dependency policy remains in CONTRIBUTING.md

• Fixes [container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/api-proxy:0.27.42 #49085